# FortiGate Traffic through Actual rsyslog Relay

Recorded against /assets/index-CY6Sm-TX.js; source revision a4b4e2f; browser-observed workflow. No live target was connected.

## ACTUAL R S Y S L O G RELAY

This lab uses official FortiGate Traffic samples, forwarded through a running R S Y S L O G server and captured from real U D P output.

## REAL FORTINET LOGS

Enter the manufacturer Fortinet and product FortiGate. No firmware version is inferred from these published examples.

## PASTE EXACT RECEIVED LOGS

Paste both complete U D P captured messages, including the outer priority, relay timestamp, relay host, and original FortiGate fields.

## DECLARE R S Y S L O G HOST

Expand the Syslog forwarder hostname section and enter relay zero one, maximum one hop.

## CHECK REAL RELAY FRAMING

Both received messages have recognized relay headers. No event is marked unsafe or mismatched.

## APPLY APPROVED HOST

Apply the declared relay profile while keeping all bytes from the source messages.

## ANALYZE FORTIGATE EVENTS

Analyze the two published FortiGate Traffic messages as they were actually received after relay forwarding.

## VERIFY TWO OF TWO

Both Traffic events parsed completely. This is the actual result returned by the deployed Parser Studio Web interface.

## REVIEW REAL SECURITY FIELDS

In Review Fields compare source I P, destination I P, policy action and session identifier to the official vendor source.

## MAP STELLAR CYBER FIELDS

Inspect suggested Stellar Cyber seven point zero field mappings. The relay hostname is not the originating firewall.

## CREATE PARSER

Continue to Create Parser after confirming the real source-event fields.

## RUN FINAL SAMPLE TEST

Run Final Test and Create Files. The tested samples passed this local generation step, not live Stellar ingestion.

## VERIFY WEB FILTER HOLDOUT

Use the separate, actually relayed official FortiGate Web Filter log to perform an independent one-event validation.